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l. Executive Summary 


The European Data and Marketing industry plays a crucial role in helping marketers to effectively 
communicate reliable information and services to individuals. Reaching the right audience is 
particularly important for European small on medium sized enterprises which are trying to survive in a 
highly competitive environment. Data marketing contributes to a vibrant European business 
community, by giving them the opportunity to communicate to consumer alternative offers to well 
established brands and large commonly known online platform. 


As the leading voice for the data and marketing industry in Europe, FEDMA welcomes the European 
Commission's proposal for a Digital Services Act (DSA) and fully supports the objective to set a 
“modern rulebook across the Single Market” to protect citizens and fundamental rights online as well 
as foster innovation, growth, and competitiveness in the EU. We encourage constant dialogue with 
civil society to achieve a harmonized and balanced legal framework. 


FEDMA defends a thriving environment for marketers powered by user's trust. 


The framework established by the DSA should provide legal certainty for online services, thus 
enabling the industry to easily take on the new responsibilities. FEDMA also believes that the DSA 
should keep an approach which ensures coherence with other legal frameworks, keeping the 
existing body of EU law in mind and avoiding contradictions with other legislative initiatives currently 
in the pipeline. In addition, policymakers should avoid general bans on existing technologies, but 
rather ensure their application in full resoect of the GDPR. Finally, FEDMA stresses the need to ensure 
timely and effective enforcement of the DSA based also on the experience accumulated under the 
General Data Protection Regulation (GDPR). 
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RECOMMENDATIONS 


A. Scope and notice & actions duties 
FEDMA welcomes the progressive distribution of responsibilities across distinct categories of 
intermediary services. It is therefore paramount to provide the necessary legal certainty allowing alll 
information providers, especially SMEs, to identify in advance their respective category and weigh in 
their respective obligations.” However, further clarity is needed to avoid legal uncertainty and any 
potential “knock-on” effect on EU SMEs potentially falling in the wrong category of intermediary 
services. Such clarity is also paramount to ensure consistency with other legislations. 


Clarify the definition of “active recipient of a service” (Art.25.1): 


First, drawing lessons from the proposed Regulation for a Digital Markets Act (DMA), the term 
“recipient” should be replaced by the two distinct terms “business users” and “end users” in order to 
enhance clarity and consistency between the two legislations. Second, though Art.25.3 indicates 
that the Commission shall adopt delegated acts [...] to lay down a specific methodology for 
calculating the number of average monthly active recipients of the service in the Union, the current 
lack of a clear definition of “active recipient of a service” at this stage of the decision-making process 
risks creating legal uncertainty for online platforms that might fall within the category of “Very Large 
Online Platforms” (VLOPs), depending on the methodology. Considering that also the DMA refers to 
“active end users” and “active business users”, we suggest providing a common workable definition 
of these terms or add a number of indicators in the annex to the future regulation. 


Address only hosting services where illegal content can be disseminated to the 
public (Art.2(f)3) 


To be consistent with the objective of the proposed legislation, we suggest clarifying that the DSA 
applies only to online hosting services which host and disseminate to the public online content, 
products, and services provided by recipients of the service at their request. We believe this will be 
more in line with the objective of the DSA to tackle illegal content online and its negative impact on 
citizens and customers, thus excluding purely B2B services (e.g. advertising servers) where the content 
is only accessible to the two parties or only the business users or services where hosting is a purely 
ancillary feature related to the provisions of the main service, e.g. logistics’ service providers who - as 
part of their logistics’ services - store information, provided by the recipient of the service, related to 
the shipment for tracking and tracing purposes or other customer related information. 


Include search engines in the scope of the regulation 


We believe that the definition of recommender systems in Art.2(0) should clarify whether such 
recommender systems are also referred to the ones featured within search engines. A more explicit 
inclusion of search engines in the scope would ensure that the new transparency requirements for 
recommender systems, and the broader provisions addressing VLOPs, are also consistently applied 
to search engines. 


Provide further clarifications for the definition of online platforms: 


Art.2(h) provides an extensive definition of online platforms. Though we understand the Commission’s 
intention to set horizontal rules for broad categories of intermediary services, we believe it will 
strengthen legal certainty to provide more specific definitions for certain intermediary services based 
on their active or passive nature as to avoid confusion between different categories, for instance a 
platform that provides cloud services being seen as a marketplace. 
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Clarify intermediary services’ notice & action duties 

FEDMA welcomes the proposed provisions aiming to set clear and common rules on Notice & Action 
mechanisms which are currently fragmented across the EU. In this context, we call on policymakers 
to ensure that the new obligations are sufficiently clear and proportionate. For example, we believe 
that such obligations for hosting services should not go beyond the information requirements set in 
Article 14: this will avoid situations where hosting services are caught between the individuals/entity 
notifying the illegal content and the recipient of this notification. In parallel, though we welcome the 
provisions under Art.21 that clarifies online platforms’ duties in respect to national law enforcement 
or judicial authorities, we stress the need for further clarifications on the definition of "safety of persons" 
which can be very broad, thus creating legal uncertainty. 


B. Alignment with the GDPR and forthcoming Digital Markets Act 
There is already an existing body of legislation covering online services at national and EU-level, so it 
will be crucial that the DSA works coherently with all the rules already in place with special regard to 
the General Data Protection Regulation (GDPR) and the recently adopted “New Deal for 
Consumers”. In parallel, the DSA will also need to consider the policy objectives set for other 
legislative proposals currently in the “EU pipeline”, notably the initiative on political advertising under 
the European Democracy Action Plan and the proposal for a Digital Markets Act (DMA). 


Avoid overriding interpretations of the GDPR’s legal bases for personal data 


processing (Recital 52) 

FEDMA considers paramount to ensure consistency with the GDPR which is one of the main 
regulations of the entire value chain of the direct-marketing sector. That’s why, FEDMA is concerned 
about the wording of Recital 52 which despite stressing that the DSA is “wifhout prejudice to the 
application of the relevant provisions of Regulation (EU) 2016/679", it seems to offer a unique 
interpretation of the GDPR by highlighting “fhe need to obtain consent of the data subject prior to 
the processing of personal data for targeted advertising”. Though consent remains one of the legal 
grounds used to process users’ data in the context of targeting advertising, the GDPR does not a 
provide Specific or hierarchical lawful bases for such processing. Conversely, the GDPR supports a 
flexible risk-based approach which aligns the level of safeguards and obligation to the level of risks 
inherent to the processing. FEDMA thus calls on the Commission to rectify Recital 52 to better align it 
with the GDPR. 


Ensure competition-neutral mitigation measures (Art.27) 

FEDMA voices concerns about the risk of certain mitigation measures overlooking potential trade- 
offs between different values which, while potentially tackling the identified systemic risk, could 
negatively affect VLOPs’ business users. This could be exemplified by Google's phase out of third- 
party cookies: a response to privacy concerns which is expected to increase marketers’ 
dependence on Google’s walled garden platform, likely resulting in a decrease of market 
contestability!. In this regard, Recital 58 underlines that mitigation measures “should be proportionate 


t We already see gatekeeping platforms using privacy and data protection rules to justify restriction of access to other players. 
in July 2020, FEDMA, together with other trade associations, alerted on the upcoming changes that Apple has announced for 
the Apple Identifier for Advertiser (IDFA) and the substantial impact such changes would have on the entire mobile app 
industry, and on advertising revenue for online publisher. Similarly, the announce by Google in January 2020 with respect to 
their browser Chrome’s handling of third-party cookie will have significant impact on an entire industry. These moves by 
gatekeeper platforms restrict the ability for players in the online advertising ecosystem to directly access users on their devices 
and request granular consent while providing users with transparency. Such platform de facto imposes their definition of 


Federation of European Data and Marketing 


Av. Des Arts 43, 5th Floor, 1040 Brussels 
+32 2 779 4268 www.fedma.org 


Page4 


FEDMA Position paper 


Federation of European Data and Marketing 


in light of the very large online platform’s economic capacity and the need to avoid unnecessary 

restrictions on the use of their service”, but it only refers to the “potential negative effects on the 

fundamental rights of the recipients of the service”. In parallel, Recital 59 leaves up to the VLOPs the 

possibility to involve other interested parties when conducting their impact assessments and 

adopting mitigation measures. Therefore, in order to ensure synergies with current proposal for a 

Digital Markets Act, FEDMA calls on policymakers to: 

e require VLOPs to take also into account competition criteria and Platform-to-Business 
relationships when designing mitigation measures. 

e Clarify the conditions for the involvement of other interested parties in the VLOPs’ impact 
assessments and mitigation measures. 


C. Transparency requirements for online advertising 

FEDMA supports the Commission’s approach towards online advertising through a technology 
neutral legislation, including targeting advertising. Recital 4 confirms indeed the technology neutral 
character of the proposed DSA in light of the broader objective to stimulate innovation through legal 
certainty, harmonized rules and proportionate obligations rather than through one-size-fits-all models 
labelling specific technologies as “inadequate”. Transparency is essential in building trust in the 
advertising industry, and in the data economy in general. The 2018 GDMA Global data privacy report 
showed that 88% of consumers cite transparency as the key to trusting organisations. In this context, 
FEDMA wishes to leverage the “AdChoices Icon” 


Ensure policy coherence with existing legislation and self-regulatory initiatives 


for commercial advertising (Art.24 & Art.30) 


e Though in line with the aspiring horizontal nature of the draft DSA, the lack of a clear distinction 
between commercial and political advertising in the definition of “advertisement” in Art.2(n) 
results in a ‘one-size fits all approach’ for two forms of advertising which should be treated 
differently. Firstly, FEDMA believes that this is reflected in some transparency obligations on online 
advertising which are more associated to political advertising. For instance, while the requirement 
of Article 24(1)b to clarify on whose behalf the advertisement is displayed is fundamental for 
political advertising as the nature of the ad might not be clear, applying such requirement on 
commercial advertising seems questionable as a commercial advertiser aims to market his own 
products or services, thus including this information in the ad itself. 


e Secondly, the lack of a distinction between commercial and political advertising seems to ignore 
that commercial advertising is already subject, as also underlined in the DSA Impact Assessment, 
to several existing rules, such as the Unfair Commercial Practices Directive (UCPD), the GDPR, the 
Audiovisual Media Services Directive (AVMSD) as well as a comprehensive self-regulatory legal 
framework under which self-regulatory bodies have devoted time and resources to develop 
codes of conduct related to advertising. By contrast, subject to regulatory fragmentation across 
the EU, political advertising is expected to be regulated under the European Democracy Action 
Plan. 


e In light of this “legislative asymmetry” between commercial and political advertising and the 
different associated risks, FEDMA calls for 

providing a clear distinction between these two concepts, in line with existing definitions of 
commercial advertising in the UCPD and AVMSD. 


(i 


= 


privacy, and their interpretation of the GDPR to an entire ecosystem, limiting the ability for publisher to derive revenue from 
online advertising, and limit the ability for user to make meaningful choice with regard to the services they which to access, 
and their privacy. 
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(ii) ensuring the DSA advertising requirements are coherent with the existing framework, without 
overriding sector-specific legislation and the work of national advertising self-regulatory 
organisations (SROs) across the EU. 


Clarify advertising transparency requirements for online platforms (Art.24) 

Article 24 aims to reinforce the transparency requirements for digital advertising under the current E- 
Commerce Directive (ECD) though the provision of relevant information in relation to the specific 
advertisement shown to the individual user at the time when the advertisement is displayed. 
However, FEDMA is concerned about the unclear wording of the transparency requirement in 
Art.24(c), i.e. “meaningful information” and “main parameters”. This wording creates legal and 
technical uncertainty on the extent of information to provide in order to comply with the requirement, 
thus potentially leading to an uneven implementation across online platforms and different levels of 
transparency provided to the users. Accordingly, FEDMA urges policymakers to provide further clarity 
on this requirement also based on existing industry’s initiatives, including the AdChoices Icon. 


Set the right balance for transparency while protecting personal data and 


commercially sensitive information (Art.30) 

Art.30.1 clearly states that the VLOPs’ repositories shall “not contain any personal data of the 
recipient of the service” while Art.30.2(d) requires VLOPs to include in these “publicly available” 
repositories information on the parameters used to target “one or more particular groups of 
recipients”. However, as these parameters unveil specific characteristics of one or more users (e.g. 
gender, location, interests etc.), they constitute personal data according to Art.4(1) of the GDPR. The 
public nature of these repositories also risks exposing commercially sensitive information through the 
analysis of the data VLOPs will be required to provide. This includes, for example, the advertisers and 
marketers relying on a specific VLOP (Art.30(2)b) as well as the inferred amount of marketing money 
spent for each advertisement (Art.30(2)e). Though FEDMA believes in the benefits of increasing 
transparency in the advertising ecosystem, the future regulation should strike the right balance 
between (i) increasing transparency, (ii) strengthening users’ control over their data and (iii) 
protecting commercially sensitive information. 


Ensure a fair environment for all actors in the advertising supply chain 

Art.34 points out that the development of advertising-related Codes of Conduct should occur “in full 
respect for the rights and interests of all parties involved, and a competitive, transparent and fair 
environment in online advertising”. FEDMA supports the Commission's approach to ensure a fair 
online environment for all actors in the advertising ecosystem. We therefore believe that this point 
should also be emphasised in regard to the transparency requirements in Art.24 and Art.30. Taking 
into account that the provision of specific information relating to each advertisement will likely 
require the involvement of other parties in the advertising supply (e.g. marketers, adtech 
companies), it is paramount to ensure that online platforms and VLOPs do not pass on them all costs 
of compliance or technical requirements. 


Focus on abusive data practices while avoiding knock-on effects on SMEs relying 


on online advertising 

e FEDMA is concerned about some policymakers’ proposals to ban or impose unnecessary 
restrictions to targeting advertising. We strongly believe that policymakers should make a clear 
distinction between the technology itself and the data practices of certain players in monopolistic 
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situation. As also underlined by the Observatory of the Online Platform Economy?, the lack of 
transparency and accountability in the online advertising ecosystem is associated to issues of 
dominance which adversely affect both users and businesses. We therefore believe that the 
proposed transparency requirements for online advertising should go hand in hand with the 
forthcoming Digital Markets Act (DMA) in order to tackle many of the issues around consumer 
harms related to online advertising, especially targeting advertising. 


e Thousands of local and regional SMEs rely on targeting advertising to reach customers and 
prospects with relevant offers, raise brand awareness and scale at a global level. Taking into 
account the economy's increasing shift to the digital level, especially in a post-COVID era, it is 
even more fundamental for these smaller players, which are facing significant economic hurdles 
(in contrast to the gatekeeper platforms’), to exceed their physical boundaries and proactively 
connect with potential customers in a digital environment. During the coronavirus pandemic, 
SMEs increased their use of targeted advertising on social media across sectors like telecoms and 
tech (34%), as well as less digitally focused SMEs like agriculture (30%) and manufacturers and 
sellers of intermediate products (more than 25%) 4. 


e = In this context, banning targeting advertising would negatively affect the competitiveness of SMEs 
and start-ups vis-d-vis large platforms with their strong network effects and systemic data practices 
which can be addressed under the existing EU legal framework for data protection and privacy. 
Furthermore, as this framework already provides users with the possibility to express their 
preferences regarding personalized services, the proposal to set an opt-in system for targeting 
advertising at the platform level not only overlaps with the existing framework, but it would also 
reinforce the gatekeeper role of web browsers whose settings determine access to individual 
websites>. We therefore believe that the future regulation should strike the right balance between 
the protection of the rights of individual and the rights of businesses to promote their operations 
through advertising. 


Incentivize the GDPR’s risk-based approach to further trust in the online 


advertising ecosystem 


e As targeting advertising is based on users’ personal data, the processing of information from end- 
user is without doubt subject to the GDPR’s principles set out in Art.5 which are binding on alll 
processing of personal data. FEDMA believes that a general ban on targeting advertising creates 
a one-size-fits-all solution which overlooks the GDPR’s risk-based approach, thus undermining EU's 
efforts to uptake the data economy and ensuring fair and open digital markets. The concept of 
pseudonymization developed in the GDPR reflects such approach. While the GDPR clarifies that 
pseudonymized data is personal data, it also recognizes that data which have been 
pseudonymized present less risk to the data subject (GDPR recital 28). 


e Asan example, the concept of pseudonymization can apply to cookies/online identifiers, used 
for targeting advertising activities: when personal information about an individual is 
pseudonymized, advertisers could serve online advertisement on the basis of general 
characteristics (e.g. preference for food and wine) without having access to specific personal 
information about them. Differential privacy is another example of a risk-based technique 


2 Observatory on the Online Platform Economy, Market power and transparency in open display advertising — a case study, March 
2021 

3 Big Tech Companies Reap Gains as Covid-19 Fuels Shift in Demand, WST, October 2020 

* Digital Tools in Crisis and Recovery, Small and Medium Business Report, Deloitte LLP, October 2020, p13. 

5 The proposal to require providers of intermediary services to obtain consent from the recipients of their service, in order to 
provide them with targeted advertising seems to mirror the provision under Article 10 of the proposed ePrivacy Regulation 
which would impose an obligation on providers of software permitting electronic communications to ask end-users for consent 
to allow third parties to store and process information from their terminal equipment. In doing so, both proposals would further 
strengthen the gatekeeper position of web browsers by allowing their software settings to override user consent for specific 
websites. 
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increasingly used by companies which allows them to process users’ data to improve their 
products and services without hindering users’ privacy by means of algorithmically injecting “noise 
and inaccuracies” into data, thus preventing re-identification and ID linkage. 


e The GDPR’s risk-based approach therefore enables marketers to take into consideration all the 
relevant factors that impact personal data processing (e.g. whether in a B2B or B2C environment) 
and to apply the necessary safeguards in order to protect individuals, while furthering innovation 
and the technology neutral aspects of the instrument. As such, FEDMA believes that the DSA’s 
transparency requirements coupled with a better application and enforcement of the GDPR risk- 
based approach can significantly contribute to address the shortcomings of the targeting 
advertising ecosystem. 


D. Advertising self-regulation & Codes of Conduct 


Promote existing self-regulatory solutions for online advertising transparency 


FEDMA stresses that the current system of targeting ads is already evolving, spearheaded by a 
number of industry’s initiatives which aim to increase transparency. The current approach is to 
empower consumers “by giving them transparency, such as via the “AdChoices Icon”. The 
AdChoices Icon is the result of a pan-European self-regulatory program launched in 2012, the 
European Interactive Digital Advertising Alliance (EDAA) of which FEDMA is a founder. On the right 
corner of many advertisements, the AdChoices Icon aims to guide end-users to real time information 
about which company delivered a specific ad and based on what information, including (i) the Third 
Party’s identity and contact details, (ii) the types of data collected and used for the purpose of 
providing interest-based advertising, including an indication of whether any data is ‘personal data’ 
or ‘sensitive personal data’, (iii) the purpose(s) for which interest-based advertising data is processed 
and the recipients or categories of recipient to whom such data may be disclosed as well as (iv) a 
clear link to the consumer choice platform at YourOnlineChoices.eu. The latter represents a pan- 
European portal which provides further information about digital data-driven advertising, a 
preference management tool to turn on/off interest-based ads in one-click. The website also 
encourages consumers to address any queries or complaints independently to the well-established 
network of national advertising self-regulatory organizations under the umbrella of EASA - the 
European Advertising Standards Alliance. In the process of integrating new functionalities, FEDMA 
thus believes that the AdChoices Icon can significantly contribute to set the right balance between 
innovation and consumer’s empowerment. 


Ensure coherence with existing national codes of conduct for commercial 


(online) advertising (Art.36) 


FEDMA welcomes that Article 36 of the proposal recognises the value of codes of conduct to further 
harmonisation at the EU level and responsible behaviour in the online advertising ecosystem. 
However, commercial online advertising is already subject to self- and co-regulatory best practices 
developed by both governments and industry organisations such as the European Advertising 
Standards Alliance (EASA) and its network of national self-regulatory bodies. Regularly updated to 
address emerging trends and risks, national advertising codes are significant contextual instruments 
reflecting cultural and societal norms. Against this background, FEDMA believes that the DSA should 
make reference (at least in its Recital) to such codes of conducts while ensuring no overlaps between 
the proposed code of conduct in Art.36 and existing self- and co-regulatory best practices. We 
therefore recommend renaming this article from “Codes of conduct for online advertising” to “Codes 
of conduct for online advertising transparency”, since it specifically aims to address issues connected 
with further transparency of online advertising. 
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E. DSA interpretation & enforcement 
Except for some differences, the proposed governance structure shares many commonalities with 
the governance mechanisms under the GDPR, including the Data Protection Authorities (DPAs), the 
European Data Protection Board (EDPB) and to a lesser extent, the Commission’. As a member of the 
Commission’s GDPR Multi-stakeholder expert group, FEDMA wishes to leverage its accumulated 
experience under the GDPR to provide the following recommendations concerning the 
enforcement and implementation of the future DSA. 


Promote a harmonised European interpretation of the DSA 

Drawing lessons from the GDPR, the implementation of the DSA should avoid or minimise 
fragmentation among Member States in application of the law. As also underlined in the 
Commission's first report on the evaluation and review of the GDPR, legal fragmentation has come 
from three main areas: (i) provisions in the GDPR that allow for Member States to legislate or provide 
their own specifications, (ii) Member States’ different approach towards derogations permitted 
under the GDPR, as well as (iii) significant inconsistencies between guidelines provided by the 
European Data Protection Board (EDPB) and by the Data Protection Authorities (DPA), often resulting 
in national legislation going beyond the margins set by the GDPR. From our perspective, legal 
fragmentation poses unnecessary burden on companies, especially SMEs, and jeopardises the 
effective functioning of the internal market, thus going against the objective of the proposed DSA to 
introduce a set of uniform rules at Union level. In this context, FEDMA recommends policymakers to 
limit, to the extent possible, Member States’ discretion and derogations in the application of the 
proposed DSA as well as to establish a “consistency assessment procedure” within the EBDS for 
guidance issued nationally by the DSCs in order to ensure that the DSA is always interpreted in a 
European manner. 


Provide adequate enforcement capacity 

FEDMA welcomes the proposed provisions for enhanced supervision of VLOPs under Section 3 of the 
DSA. As highlighted by the implementation of the GDPR, the management of cross-border cases has 
proved to be challenging due to, amongst others, the lack of sufficient resources allocated to DPAs 
across the EU as well as the concentration of many cases on a few Member States (i.e. Ireland and 
Luxembourg) which have found themselves overwhelmed. By contrast, consolidating regulatory 
powers against VLOPs within the Commission may foster efficiency and speediness in oversight 
procedures, thus overcoming some of the drawbacks identified under the GDPR’s enforcement. In 
this context, FEDMA calls on policymakers to allocate adequate resources to the Commission 
enabling it to provide the necessary support to national DSCs and fill in the gaps of their limited 
national capacities. 


Distribute clear roles and responsibilities among different regulatory authorities 
FEDMA welcomes the provision under Art.38.2 requiring Member States to clearly define the tasks of 
other regulatory authorities designated in addition to the DSC. However, we believe that a clear and 
public allocation of responsibilities should take place also when a Member States appoint a sole DSC 
to avoid overlaps between questions relating to different, though related, areas, notably consumer 
law, antitrust, illegal content, and data protection. In order to operate properly, businesses require 


e Chapter IV of the proposed DSA lays down the provisions concerning the implementation and enforcement of the 
Regulation. In doing so, it provides for the setting of a new governance structure comprising newly established regulatory 
authorities at national level called Digital Services Coordinators (DSC), a new advisory body at the EU level named the 
European Board for Digital Services (EBDS) and the Commission. 
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legal stability and certainty supported by a harmonised and coherent legal framework and efficient 

coordination among different regulatory authorities. As such, FEDMA calls on policymakers to 

e clearly define the area(s) of competence of the Digital Services Coordinators in respect to other 
areas under the responsibilities of existing regulatory authorities, especially Data Protection 
Authorities. 

e set the ground for formal consultation/cooperation procedures among such authorities in order 
to avoid conflict of interpretation, and in particular to preserve the one stop shop mechanism 
under the GDPR. 


PROPOSED AMENDMENTS 


European Commission’s text FEDMA’s proposed amendments 
A clear legal framework 

Article 2: [...] Art. 2: [...] 

(b) ‘recipient of the service’ means any natural or | {p} “recipient of the service’ means any natural 

legal person who uses the relevant intermediary who—uses—the relevant 

service; ice; 
(b1) ‘End user’ means any natural or legal 
person using the relevant intermediary service; 
(b2) ‘Business user’ means any natural or legal 
person acting in a commercial or professional 
capacity using the relevant intermediary 
service; 

Article 2(f)3 Article 2(f)3 


-a ‘hosting’ service that consists of the storage of | a ‘hosting’ service that consists of the storage of 
information provided by, and at the request of, a | information provided by, and at the request of, 
recipient of the service; a recipient of the service, unless 

(i) the recipient of the service is a legal person 
and the information stored by the hosting 
service provider cannot or is not meant to be 
disseminated to the public for technical 
reasons or based on the contractual 
agreement between the hosting service 
provider and the recipient of the service; 

(ii) or that activity is a minor and purely ancillary 
feature of another service and, for objective 
and technical reasons cannot be used 
without that other service, and the 
integration of the feature into the other 
service is not a means to circumvent the 
applicability of this Regulation. 


Recital 40 Recital 40 


The obligation to put in place notice and action | The obligation to put in place notice and action 
mechanisms should apply, for instance, to file | mechanisms should apply, for instance, to file 
storage and sharing services, web hosting | storage and sharing services, web hosting 
services, advertising servers and paste bins, in as | services, advertising servers and paste bins, in as 
far as they qualify as providers of hosting services | far as they qualify as providers of hosting 


covered by this Regulation. services covered by this Regulation. 
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Recital 52 


The requirements of this Regulation on the 
provision of information relating to advertisement 
is without prejudice to the application of the 
relevant provisions of Regulation (EU) 2016/679, in 
particular those regarding the right to object, 
automated individual decision-making, including 
profiling and specifically the need to obtain 
consent of the data subject prior to the 
processing of personal data for targeted 
advertising. 


Recital 52 


The requirements of this Regulation on the 
provision of information relating to 
advertisement is without prejudice to the 
application of the relevant provisions of 
Regulation (EU) 2016/679, in particular those 
regarding the right to object, automated 
individual decision-making, including profiling 
and specifically the need to obtain consent of 
the-data subiect oror to the processing of 


Article 30 


Very large onlne platforms that display 
advertising on their online interfaces shall compile 
and make publicly available through application 
programming interfaces a repository containing 
the information referred to in paragraph 2, until 
one year after the advertisement was displayed 
for the last time on their online interfaces. They 
shall ensure that the repository does not contain 
any personal data of the recipients of the service 
to whom the advertisement was or could have 
been displayed. 

2. The repository shall include at least all of the 
following information: 

(a) the content of the advertisement; 

(6) the natural or legal person on whose behalf 
the advertisement is displayed; 

(c) the period during which the advertisement 
was displayed; 

(d) whether the advertisement was intended to 
be displayed specifically to one or more 
particular groups of recipients of the service and 
if so, the main parameters used for that purpose; 
(e) the total number of recipients of the service 
reached and, where applicable, aggregate 
numbers for the group or groups of recipients to 
whom the advertisement was targeted 


specifically. 


Article 30 


Very large online platforms that display 
advertising on their online interfaces shall 
compile and make publicly available through 
application programming interfaces a 
repository containing the information referred to 
in paragraph 2, until one year after the 
advertisement was displayed for the last time on 
their online interfaces. They shall ensure that the 
repository does not only contain any 
pseudonymized or anonymized data of the 
recipients of the service to whom the 
advertisement was or could have been 
displayed. 

2. The repository shall include at least all of the 
following information: 

(a) the content of the advertisement; 

(b) the natural or legal person on whose behalf 
the advertisement is displayed; 

(c) the period during which the advertisement 
was displayed; 

(d) whether the advertisement was intended to 
be displayed specifically to one or more 
particular groups of recipients of the service and 
if so, the main parameters used for that purpose; 
(e) the total number of recipients of the service 
reached and, where applicable, aggregate 
numbers for the group or groups of recipients to 
whom the advertisement was targeted 


specifically. 
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Article 36(1) 
Codes of conduct for online advertising 


The Commission shall encourage and facilitate 
the drawing up of codes of conduct at Union 
level between, online platforms and other 
relevant service providers, such as providers of 
online advertising intermediary services or 
organisations representing recipients of the 
service and civil society organisations or relevant 
authorities to contribute to further transparency in 
online advertising beyond the requirements of 
Articles 24 and 30. 


Article 26(1) 


Very large online platforms shall identify, analyse 
and assess, [...], at least once a year thereafter, 
any significant systemic risks stemming from the 
functioning and use made of their services in the 
Union. This risk assessment shall be specific to their 
services and shall include the following systemic 
risks: 


(a) the dissemination of illegal content 
through their services; 
(b) any negative effects for the exercise of 


the fundamental rights to respect for private and 
family life, freedom of expression and information, 
the prohibition of discrimination and the rights of 
the child, as enshrined in Articles 7, 11, 21 and 24 
of the Charter respectively; 


[...] 


Article 36(1) 
Codes of conduct for online advertising 
transparency 


The Commission shall encourage and facilitate 
the drawing up of codes of conduct at Union 
level between, online platforms and other 
relevant service providers, such as providers of 
online advertising intermediary services or 
organisations representing recipients of the 
service and civil society organisations or 
relevant authorities to contribute to further 
transparency in online advertising beyond the 
requirements of Articles 24 and 30. Codes of 
conduct for online advertising are without 
prejudice to existing national self and co- 
regulatory practices and codes. 


Coherence with other legislations 


Article 26(1) 


Very large online platforms shall identify, 
analyse and assess, [...], at least once a year 
thereafter, any significant systemic risks 
stemming from the functioning and use made 
of their services in the Union. This risk assessment 
shall be specific to their services and shall 
include the following systemic risks: 


(a) the dissemination of illegal content 
through their services; 
(b) any negative effects for the exercise of 


the fundamental rights to respect for private 
and family life freedom of expression and 
information, the prohibition of discrimination 
and the rights of the child, as enshrined in 
Articles 7, 11, 21 and 24 of the Charter 
respectively; 


[...] 


Article 26.3: 


Article 26.3 


When conducting risk assessments, very large 
online platforms shall involve representatives of 
the recipients of the service, representatives of 
groups potentially impacted by their services, 
independent experts and civil society 
organisations. Their involvement shall be 
tailored to the specific systemic risks that the 
very large online platform aim to assess. 
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Recital 57 


Three categories of systemic risks should be 
assessed in-depth. [...] A second category 
concerns the impact of the service on the 
exercise of fundamental rights, as protected by 
the Charter of Fundamental Rights, including the 
freedom of expression and information, the right 
to private life, the right to non-discrimination and 
the rights of the child. [...] A third category of risks 
concerns the intentional and, oftentimes, 
coordinated manipulation of the platform's 
service, with a foreseeable impact on health, 
civic discourse, electoral processes, public 
security and protection of minors, having regard 
to the need to safeguard public order, protect 


Recital 57 


Three categories of systemic risks should be 
assessed in-depth. [...] A second category 
concerns the impact of the service on the 
exercise of the fundamental rights, as protected 
by the Charter of Fundamental Rights, including 
the freedom of expression and information, the 
fight to—ornvate—tfe, the right to non- 
discrimination and the rights of the child. [...] A 
third category of risks concerns the intentional 
and, oftentimes, coordinated manipulation of 
the platform's service, with a foreseeable 
impact on health, civic discourse, electoral 
processes, public security and protection of 
minors, having regard to the need to safeguard 


privacy and fight fraudulent and deceptive | public order,—pretect—privacy and fight 

commercial practices. fraudulent and deceptive commercial 
practices. 

Article 27(1) Article 27(1) 


Very large online platforms shall put in place 
reasonable, proportionate and effective 
mitigation measures, tailored to the specific 
systemic risks identified pursuant to Article 26. [...] 


Very large online platforms shall put in place 
reasonable, proportionate and effective 
mitigation measures, with the involvement of 
representatives of the recipients of the service, 
representatives of groups potentially impacted 
by their services, independent experts and civil 
society organisations, tailored to the specific 
systemic risks identified pursuant to Article 26. 


[...] 


Recital 58 


[...JAny measures adopted should respect the 
due diligence requirements of this Regulation 
and be effective and appropriate for mitigating 
the specific risks identified, in the interest of 
safeguarding public order, protecting privacy 
and fighting fraudulent and deceptive 
commercial practices, and should be 
proportionate in light of the very large online 
platform's economic capacity and the need to 
avoid unnecessary restrictions on the use of their 
service, taking due account of potential 
negative effects on the fundamental rights of the 
recipients of the service. 


Recital 58 


[....Any measures adopted should respect the 
due diligence requirements of this Regulation 
and be effective and appropriate for mitigating 
the specific risks identified, in the interest of 
safeguarding public order, protecting privacy 
and fighting fraudulent and deceptive 
commercial practices, and should be 
proportionate in light of the very large online 
platform's economic capacity and the need to 
avoid unnecessary restrictions on the use of their 
service, taking due account of potential 
negative effects on the fundamental rights of 
the recipients of the service, and on market 
contestability without prejudice to Regulation 
2020/0374. 
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Recital 59 


Very large online platforms should, where 
appropriate, conduct their risk assessments and 
design their risk mitigation measures with the 
involvement of representatives of the recipients 
of the service, representatives of groups 
potentially impacted by their services, 
independent experts and civil society 
organisations. 


Article 38.2 


Where a Member State designates more than 
one competent authority in addition to the Digital 
Services Coordinator, it shall ensure that the 
respective tasks of those authorities and of the 
Digital Services Coordinator are clearly defined 
and that they cooperate closely and effectively 
when performing their tasks. The Member State 
concerned shall communicate the name of the 
other competent authorities as well as their 
respective tasks to the Commission and the 
Board. 


Timely & effectiv 


Recital 59 


Very large online platforms should shall-where 
appropriate, conduct their risk assessments and 
design their risk mitigation measures with the 
tailored involvement of representatives of the 
recipients of the service, representatives of 
groups potentially impacted by their services, 
independent experts and civil society 
organisations. 

e enforcement 

Article 38.2 


Where a Member State designates a Digital 
Services Coordinator or more than one 
competent authority in addition to the Digital 
Services Coordinator, it shall ensure that the 
respective tasks of those authorities and of the 
Digital Services Coordinator are clearly defined 
in respect to other national competent 
authorities and that they cooperate closely and 
effectively when performing their tasks. The 
Member State concerned shall communicate 
the name of the other competent authorities as 
well as their respective tasks to the Commission 
and the Board. 


Article 49 


Where necessary to meet the objectives set out 
in Article 47(2), the Board shall in particular: 
(a) support the coordination of 
investigations; 

(6) support the competent authorities in the 
analysis of reports and results of audits of very 
large online platforms to be transmitted pursuant 
to this Regulation; 

(c) issue opinions, recommendations or advice to 
Digital Services Coordinators in accordance with 
this Regulation; 

(d) advise the Commission to take the measures 
referred to in Article 51 and, where requested by 
the Commission, adopt opinions on draft 
Commission measures concerning very large 
online platforms in accordance with this 
Regulation: 

(e) support and promote the development and 
implementation of European standards, 
guidelines, reports, templates and code of 
conducts as provided for in this Regulation, as 


joint 


Article 49 


Where necessary to meet the objectives set out 
in Article 47(2), the Board shall in particular: 
(a) support the coordination of 
investigations; 

(b) support the competent authorities in the 
analysis of reports and results of audits of very 
large online platforms to be transmitted 
pursuant to this Regulation; 

(c) issue opinions, recommendations or advice 
to Digital Services Coordinators in accordance 
with this Regulation; 

(d) assess that the consistency of opinions and 
guidance issued nationally by Digital Services 
Coordinators is in accordance with this 
Regulation; 

(ed) advise the Commission to take the 
measures referred to in Article 51 and, where 
requested by the Commission, adopt opinions 
on draft Commission measures Concerning very 
large online platforms in accordance with this 


joint 


Regulation; 


Federation of European Data and Marketing 


Av. Des Arts 43, 5th Floor, 1040 Brussels 
+32 2 779 4268 www.fedma.org 


Page 1 4 


FEDMA 


Federation of European Data and Marketing 


Position paper 


well as the identification of emerging issues, with 
regard to matters covered by this Regulation. 


(de) support and promote the development 
and implementation of European standards, 
guidelines, reports, templates and code of 
conducts as provided for in this Regulation, as 
well as the identification of emerging issues, with 
regard to matters covered by this Regulation. 
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